A written version of the interactive roadmap above — every station, what you'll learn, and a small thing to build — laid out for reading, reference and search.
Foundations Start here
F1. Cloud & Shared Responsibility
Beginner · 50 min
The cloud is someone else's computers, rented by the second and driven by APIs. Learn the service models (IaaS/PaaS/SaaS), regions and availability zones, and the shared-responsibility model — AWS secures the cloud, you secure what you put in it. This framing shapes every later decision.
Skills: IaaS / PaaS / SaaS · Regions & availability zones · Shared responsibility · The AWS console & CLI
Build it: Draw the shared-responsibility line for a web app on EC2 vs on Lambda. Who patches the OS in each case — and why does that matter?
✓ Checkpoint: Draw the shared responsibility line for one managed service, and name what you wrongly assumed AWS handles.
F2. Compute: EC2 & Lambda
Beginner · 65 min
Compute is where code runs. Learn EC2 (virtual machines you manage), Lambda (functions you do not), and the spectrum between — instances, AMIs, instance types, and the serverless tradeoff. Choosing the right compute model is the first big architecture fork on AWS.
Skills: EC2 instances & AMIs · Instance types & sizing · Lambda functions · Servers vs serverless
Build it: A spiky, event-driven workload runs on an always-on EC2 box. Argue for moving it to Lambda — and name one case where you would not.
✓ Checkpoint: Justify EC2 over Lambda for one workload and the reverse for another. The same answer for both means you have a default, not a reason.
F3. Storage: S3, EBS & EFS
Beginner · 60 min
AWS has a storage type for every shape of data: S3 (object storage — the backbone of the cloud), EBS (block volumes for instances), and EFS (shared file systems). Learn durability, storage classes, and lifecycle policies. S3 alone underpins a huge fraction of the internet.
Skills: S3 object storage & classes · EBS block volumes · EFS shared files · Durability & lifecycle policies
Build it: Store user uploads cheaply but keep hot files fast. Design the S3 storage classes + lifecycle rules that move cold data to Glacier.
✓ Checkpoint: Pick an S3 storage class for real data and say what retrieval costs you when you are wrong.
F4. Networking: VPC
Intermediate · 70 min
Every AWS resource lives in a network you define. Learn the VPC — subnets (public/private), route tables, internet and NAT gateways, and security groups vs NACLs. Networking is the most common source of "why can this not reach that?" — master it early and save yourself pain.
Skills: VPC & subnets · Route tables & gateways · Security groups vs NACLs · Public vs private subnets
Build it: Put a database in a private subnet but let it reach the internet for updates. Which gateway and rules make that work securely?
✓ Checkpoint: Explain the difference between a security group and a NACL in terms of statefulness, and which one bites you first.
F5. IAM & Identity
Intermediate · 60 min
IAM decides who can do what. Learn users, roles, policies, and the principle of least privilege — plus why roles (temporary credentials) beat long-lived keys. Misconfigured IAM is behind most cloud breaches; getting identity right is the foundation of cloud security.
Skills: Users, roles & policies · Least privilege · Roles vs access keys · Policy evaluation
Build it: A Lambda needs to read one S3 bucket and nothing else. Write the least-privilege role — and explain why you never hard-code keys.
✓ Checkpoint: Explain why a role beats a long-lived access key, and what rotates in each case.
F6. Databases: RDS & DynamoDB
Intermediate · 60 min
AWS runs your databases so you do not have to. Learn RDS (managed relational — Postgres, MySQL) and DynamoDB (managed NoSQL, single-digit-ms at any scale). Understand when each fits and the managed-service tradeoff: less control, far less operational burden.
Skills: RDS (managed SQL) · DynamoDB (managed NoSQL) · Read replicas & Multi-AZ · Managed vs self-run
Build it: A shopping cart needs massive scale and simple key lookups; reporting needs joins. Pick DynamoDB vs RDS for each and justify it.
✓ Checkpoint: Explain when DynamoDB is the right choice and what query becomes impossible once you commit to its key design.
Core AWS The craft
T1. Serverless
Intermediate · 65 min
Serverless lets you ship logic without managing servers: Lambda for compute, API Gateway for HTTP, and event triggers gluing services together. Learn cold starts, concurrency, and event-driven patterns. Done well, serverless scales to zero and to millions with the same code.
Skills: Lambda + API Gateway · Event triggers · Cold starts & concurrency · Event-driven patterns
Build it: Build a REST endpoint with API Gateway + Lambda + DynamoDB — no servers. Where do cold starts hurt, and how do you mitigate them?
✓ Checkpoint: Explain what causes a cold start and which of your workloads genuinely cannot tolerate one.
T2. Containers: ECS & EKS
Advanced · 70 min
When you need more control than Lambda, containers fill the gap. Learn ECS (AWS-native orchestration), EKS (managed Kubernetes), and Fargate (serverless containers — no nodes to manage). Understand the tradeoff between operational simplicity and portability.
Skills: ECS orchestration · EKS (managed Kubernetes) · Fargate (serverless containers) · ECS vs EKS tradeoffs
Build it: A team wants Kubernetes without managing control planes or nodes. Which AWS combo gives them that — and what do they give up?
✓ Checkpoint: Explain what Fargate removes and what it costs you compared with managing the nodes.
T3. Infrastructure as Code
Advanced · 65 min
Click-ops does not scale or reproduce. Declare your AWS infrastructure in code — CloudFormation (native) or Terraform (multi-cloud) — so it is versioned, reviewable, and repeatable. Learn stacks, state, and drift. On AWS, IaC is not optional at any real scale.
Skills: CloudFormation · Terraform on AWS · Stacks & state · Drift detection
Build it: Provision a VPC + EC2 + security group as code. Someone edits it in the console — how does your next deploy detect and fix the drift?
✓ Checkpoint: Explain what drift is and why detecting it matters more than preventing every manual change.
T4. Observability: CloudWatch
Advanced · 60 min
You cannot operate what you cannot see. Learn CloudWatch — metrics, logs, alarms, dashboards — plus X-Ray tracing across services. Instrumenting for the three pillars (metrics, logs, traces) is what turns a 3am outage from a guessing game into a guided fix.
Skills: CloudWatch metrics & logs · Alarms & dashboards · X-Ray tracing · The three pillars
Build it: A serverless API is intermittently slow. Which CloudWatch metric alerts you, and how does an X-Ray trace pinpoint the slow downstream call?
✓ Checkpoint: Explain what a trace shows you that metrics and logs together still do not.
T5. Messaging: SQS, SNS & EventBridge
Advanced · 60 min
Decoupled systems talk through messages, not direct calls. Learn SQS (queues), SNS (pub/sub fan-out), and EventBridge (event bus with routing). These let services absorb bursts and fail independently — the backbone of resilient, event-driven AWS architectures.
Skills: SQS queues · SNS pub/sub · EventBridge routing · Async decoupling & DLQs
Build it: An order service must trigger email, inventory, and analytics without waiting on any of them. Wire SNS fan-out — and add a DLQ for failures.
✓ Checkpoint: Justify SQS over SNS for one integration, in terms of who needs the message and how many times.
T6. CDN & DNS: CloudFront & Route 53
Intermediate · 55 min
Get content close to users and route them well. Learn CloudFront (CDN at the edge — caching, TLS termination) and Route 53 (DNS with health checks and latency/geo routing). Together they make a global app feel local and fail over gracefully across regions.
Skills: CloudFront edge caching · TLS termination · Route 53 DNS routing · Health checks & failover
Build it: Serve a global site fast and survive a regional outage. Put CloudFront at the edge and use Route 53 to route users to a healthy region.
✓ Checkpoint: Explain what CloudFront caches at the edge and what it cannot help with.
Production Operate & scale
P1. Well-Architected Framework
Advanced · 55 min
AWS distilled decades of hard lessons into six pillars: operational excellence, security, reliability, performance, cost, and sustainability. Learn to run a workload against them — it is the checklist that turns "it works" into "it works well, safely, and affordably."
Skills: The six pillars · Trade-off analysis · Well-Architected reviews · Design principles
Build it: Review a simple architecture against the six pillars. Which pillar is it weakest on, and what one change improves it most?
✓ Checkpoint: Name the weakest Well-Architected pillar in a system you know, and the pillar you traded away to strengthen it.
P2. Security & Compliance
Advanced · 60 min
Security is job zero on the cloud. Learn encryption (at rest with KMS, in transit with TLS), secrets management, network isolation, and the guardrail services (GuardDuty, Config, CloudTrail) that audit and enforce. Defense in depth, not a single wall.
Skills: Encryption (KMS) & TLS · Secrets management · CloudTrail & Config · Defense in depth
Build it: An auditor asks "who accessed this bucket last month, and is it encrypted?" Which services answer both — and how do you prove it?
✓ Checkpoint: Explain what CloudTrail answers after an incident that CloudWatch does not.
P3. High Availability & Multi-Region
Advanced · 65 min
Things fail; good architectures survive them. Learn Multi-AZ for zone failures, multi-region for regional disasters, and the RTO/RPO tradeoffs of active-passive vs active-active. Availability is designed in from the start, not bolted on after the first outage.
Skills: Multi-AZ vs multi-region · Active-passive vs active-active · RTO / RPO · Failover & backups
Build it: Your app must survive an entire AWS region going down. Sketch a multi-region design and state its RTO — and what it costs you.
✓ Checkpoint: State an RTO and RPO you would commit to in writing, and say whether multi-AZ or multi-region is required to meet them.
P4. Cost Optimization / FinOps
Advanced · 55 min
The cloud bill is a design output you own. Learn the pricing levers — on-demand vs reserved vs spot, right-sizing, autoscaling, and storage tiering — plus cost visibility tools. FinOps is the discipline of getting the same result for a fraction of the spend.
Skills: On-demand / reserved / spot · Right-sizing · Cost Explorer & budgets · Storage tiering
Build it: A dev environment runs 24/7 but is used 8 hours a day. List three changes that cut its bill by more than half.
✓ Checkpoint: Explain when spot is appropriate and what your workload must tolerate to use it.
P5. Auto-scaling & Load Balancing
Advanced · 55 min
Match capacity to demand automatically. Learn Elastic Load Balancing (ALB/NLB) to spread traffic and Auto Scaling groups to add/remove instances on metrics. Together they deliver the cloud's core promise: handle a traffic spike without paying for idle capacity off-peak.
Skills: ALB vs NLB · Auto Scaling groups · Scaling policies & metrics · Health checks
Build it: Traffic 10x's at noon and drops at night. Configure an ALB + scaling policy that adds instances on CPU and removes them when quiet.
✓ Checkpoint: Explain which metric you would scale on and why CPU is so often the wrong one.
P6. DevOps on AWS
Advanced · 55 min
Ship changes safely and often. Learn the CI/CD toolchain (CodePipeline, CodeBuild, CodeDeploy), blue-green and canary deploys, and integrating IaC into the pipeline. The goal is boring, reversible releases — deploy on every merge without holding your breath.
Skills: CodePipeline / CodeBuild / CodeDeploy · Blue-green & canary · Pipeline + IaC · Rollbacks
Build it: Design a pipeline that builds, tests, and deploys to a canary before full rollout — and rolls back automatically if error rate spikes.
✓ Checkpoint: Explain what a canary tells you that a staging environment cannot.